diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a966fe171..864d233e4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -111,7 +111,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Create embed placeholders for lint/test
@@ -247,7 +247,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       # embedded-postgres downloads a ~100 MB Postgres distribution on first use
@@ -607,7 +607,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Download dash0 dist
@@ -666,7 +666,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Download dash0 dist
@@ -1190,7 +1190,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       # Own Go-only build, not the `build` job's artifact: `build` (and the
@@ -1354,7 +1354,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       # Fixed, version-free names — the same shape the server binaries use
@@ -1589,7 +1589,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       # Fixed, version-free names: these are the exact URLs the install docs
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index e21a8bcd7..cf5ce988f 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -38,7 +38,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Clone HEAD, go build ./..., make test
@@ -56,7 +56,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Create embed placeholders for tests
@@ -115,7 +115,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Create embed placeholders
@@ -159,7 +159,7 @@ jobs:
 
       - uses: actions/setup-go@v7
         with:
-          go-version: "1.27"
+          go-version-file: server/go.mod
           cache-dependency-path: server/go.sum
 
       - name: Cache embedded PostgreSQL binaries
diff --git a/AGENTS.md b/AGENTS.md
index 6c3e1703e..e786e36f6 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -3,7 +3,7 @@
 Agent instructions for every coding agent (Claude Code, Codex, Cursor, Copilot, Gemini CLI). Each `CLAUDE.md` in the repo is a one-line `@AGENTS.md` stub so Claude Code loads the same file. Edit `AGENTS.md`, never the stub.
 
 ## Core technologies
-- **Backend**: Go 1.24+ (see `server/AGENTS.md` for details)
+- **Backend**: Go, exact version pinned in `server/go.mod` (see `server/AGENTS.md` for details)
 - **Dashboard**: React + TanStack Router (see `web/dash0/AGENTS.md` for details)
 - **Infrastructure**: Docker Compose with PostgreSQL for monitoring data storage
 - **Monitoring**: Multi-protocol ping/health checking with distributed worker system
diff --git a/server/AGENTS.md b/server/AGENTS.md
index b5bb3014e..ef9b1ce20 100644
--- a/server/AGENTS.md
+++ b/server/AGENTS.md
@@ -3,7 +3,7 @@
 This file provides backend-specific guidance for the SolidPing monitoring system.
 
 ## Core Technologies
-- **Language**: Go 1.24+
+- **Language**: Go, exact patch version pinned by the `go` directive in `go.mod`. CI reads it from there (`go-version-file`); keep the `golang:` images in the Dockerfiles on the same version
 - **HTTP Router**: go-chi/chi v5, behind the in-repo `internal/httpx` adapter that preserves error-returning handlers (`func(w, *http.Request) error`) and a `Group`/`Use` middleware tree
 - **ORM**: Bun ORM (PostgreSQL)
 - **Configuration**: koanf (YAML + environment variables)
diff --git a/server/go.mod b/server/go.mod
index d01914d95..ace03f58e 100644
--- a/server/go.mod
+++ b/server/go.mod
@@ -1,6 +1,6 @@
 module github.com/fclairamb/solidping/server
 
-go 1.27
+go 1.27.3
 
 // The RDP client library is vendored in-tree as its own module: the fork
 // carries the SolidPing patches (Unicode input, logoff PDU, tunnel dialing)